The number of safeguards they have in place make that a moot point. If it's not discovered in testing, it's sandboxed. If it gets past the sandbox, they have a killswitch that's registered to the app's specific ID. There's very little damage that an app can do if it's gone through the App Store proper.

That could be done for sideloaded apps too.

Sideloaded apps, by definition, are not tracked individually by Apple. You can't make a killswitch for an app if you don't know what the app is.

And yet the Mac has a malware killswitch. Clearly it can be done.

Source? The Mac only has the ability to prevent unsigned apps from being installed which is easily disabled. There's no killswitch for unsigned apps.